Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ca2cacb1 authored by Andy Hung's avatar Andy Hung Committed by android-build-merger
Browse files

Fix AudioEffect reply overflow 

am: 1015d94f

* commit '1015d94f':
  Fix AudioEffect reply overflow

Change-Id: I0a82abb715a31f93ac700bb0aa0295e8c06d56fd
parents 27405aa1 1015d94f

msm8909/post_proc/bundle.c

+3 −2
Original line number Diff line number Diff line
@@ -643,8 +643,9 @@ int effect_command(effect_handle_t self, uint32_t cmdCode, uint32_t cmdSize, 
        if (pCmdData == NULL ||

            cmdSize < (int)(sizeof(effect_param_t) + sizeof(uint32_t)) ||

            pReplyData == NULL ||

            *replySize < (int)(sizeof(effect_param_t) + sizeof(uint32_t) +

                               sizeof(uint16_t))) {

            *replySize < (int)(sizeof(effect_param_t) + sizeof(uint32_t) + sizeof(uint16_t)) ||

            // constrain memcpy below

            ((effect_param_t *)pCmdData)->psize > *replySize - sizeof(effect_param_t)) {

            status = -EINVAL;

            ALOGW("EFFECT_CMD_GET_PARAM invalid command cmdSize %d *replySize %d",

                  cmdSize, *replySize);

msm8909/voice_processing/voice_processing.c

+3 −1
Original line number Diff line number Diff line
@@ -563,7 +563,9 @@ static int fx_command(effect_handle_t self, 
            if (pCmdData == NULL ||

                    cmdSize < (int)sizeof(effect_param_t) ||

                    pReplyData == NULL ||

                    *replySize < (int)sizeof(effect_param_t)) {

                    *replySize < (int)sizeof(effect_param_t) ||

                    // constrain memcpy below

                    ((effect_param_t *)pCmdData)->psize > *replySize - sizeof(effect_param_t)) {

                ALOGV("fx_command() EFFECT_CMD_GET_PARAM invalid args");

                return -EINVAL;

            }

post_proc/bundle.c

+3 −2
Original line number Diff line number Diff line
@@ -621,8 +621,9 @@ int effect_command(effect_handle_t self, uint32_t cmdCode, uint32_t cmdSize, 
        if (pCmdData == NULL ||

            cmdSize < (int)(sizeof(effect_param_t) + sizeof(uint32_t)) ||

            pReplyData == NULL ||

            *replySize < (int)(sizeof(effect_param_t) + sizeof(uint32_t) +

                               sizeof(uint16_t))) {

            *replySize < (int)(sizeof(effect_param_t) + sizeof(uint32_t) + sizeof(uint16_t)) ||

            // constrain memcpy below

            ((effect_param_t *)pCmdData)->psize > *replySize - sizeof(effect_param_t)) {

            status = -EINVAL;

            ALOGV("EFFECT_CMD_GET_PARAM invalid command cmdSize %d *replySize %d",

                  cmdSize, *replySize);

voice_processing/voice_processing.c

+3 −1
Original line number Diff line number Diff line
@@ -560,7 +560,9 @@ static int fx_command(effect_handle_t self, 
            if (pCmdData == NULL ||

                    cmdSize < (int)sizeof(effect_param_t) ||

                    pReplyData == NULL ||

                    *replySize < (int)sizeof(effect_param_t)) {

                    *replySize < (int)sizeof(effect_param_t) ||

                    // constrain memcpy below

                    ((effect_param_t *)pCmdData)->psize > *replySize - sizeof(effect_param_t)) {

                ALOGV("fx_command() EFFECT_CMD_GET_PARAM invalid args");

                return -EINVAL;

            }